Security Engineer | Generalist

ARQ; Kraków; On-site; PLN 150,000 - 260,000; Full time

Benefits offered by this job

Stock options

Discretionary performance bonus

The latest tools and technology

Office policy: 3-4 days in-office

Job summary

ARQ is seeking a security leader to build and enhance a fast-growing security function in Kraków. You will design detection rules, run IR playbooks, and shape DLP and data protection across key tools. You’ll assess AWS/Kubernetes environments, drive API security, and establish third-party due diligence processes.

You’ll guide AI/agentic security, write robust governance, and collaborate with a world-class team to protect a fintech product. Office presence is expected in the office policy.

Qualifications

• 4–7 years in cyber security, ideally having built or significantly shaped the security function at a startup or high-growth company.
• 2+ years at a regulated fintech/bank/payment company.
• Hands-on experience with cloud infrastructure security (AWS, Kubernetes).
• Working knowledge of SIEM platforms and detection engineering.
• Familiarity with application security practices: threat modelling, secure code review, CI/CD pipeline hardening, and API security testing.
• Experience with endpoint security tooling (EDR/XDR) and IAM in a SaaS-heavy environment.
• Ability to assess and secure emerging AI/agentic tooling and guardrails.
• Experience running or contributing to vendor security assessments and third-party due diligence.
• Strong written and verbal communication.
• Business fluent in English.

Responsibilities

• Build and improve SIEM detection rules, alert pipelines, and automated response playbooks.
• Contribute to incident response readiness, including IR playbooks and tabletop exercises.
• Support DLP strategy and data protection controls across G Suite, Slack, and internal tooling.
• Conduct cloud security assessments across AWS and Kubernetes environments.
• Drive application security initiatives: threat modelling and API security testing.
• Assess and secure AI/agentic workflows and guardrails.
• Establish and run vendor security assessments and third-party due diligence.

Skills

Written communication

Incident response

Cyber security strategy

Security governance

Business English

Tools

AWS

Kubernetes

Datadog

CrowdStrike

Cloudflare

Google Workspace

Okta/Cloudflare Access

Job description

What you'll do

• Build and improve SIEM detection rules, alert pipelines, and automated response playbooks (Datadog SIEM, CrowdStrike, Cloudflare)

• Contribute to incident response readiness, including IR playbooks, tabletop exercises, and forensic procedures

• Support DLP strategy and data protection controls across Google Workspace, Slack, and internal tooling

• Conduct cloud security assessments across AWS and Kubernetes environments

• Drive application security initiatives: threat modelling, secure code review support, API testing, and security pipeline improvements

• Assess and secure AI/agentic workflows across the company — reviewing prompts, preventing destructive actions, and controlling data exposure

• Establish and run the vendor security assessment process — building a scalable due diligence framework for third-party onboarding

What you'll need

• 4–7 years in cyber security, ideally having built or significantly shaped the security function at a startup or high-growth company - you've been the person who sets things up, not just maintains them

• 2+ years at a regulated fintech/bank/payment company

• Hands-on experience with cloud infrastructure security (AWS, Kubernetes)

• Working knowledge of SIEM platforms and detection engineering - you've written detection rules, not just consumed alerts

• Familiarity with application security practices: threat modelling, secure code review, CI/CD pipeline hardening, and API security testing

• Experience with endpoint security tooling (EDR/XDR) and identity & access management in a SaaS-heavy environment (Google Workspace, Okta/Cloudflare Access, SSO/SCIM)

• Ability to assess and secure emerging AI/agentic tooling - you understand the risks of LLM integrations, MCP servers, and automated workflows, and can define practical guardrails

• Experience running or contributing to vendor security assessments and third-party due diligence

• Strong written and verbal communication

• Business fluent in English

Benefits

• Competitive salary and benefits

• Stock options, so you own part of what you build

• Discretionary performance bonus

• The latest tools and technology

• A world-class team that will challenge and grow your skills

• The opportunity to help build the best fintech app in Latin America

• Office Policy: 3-4 days a week in-office